US20050033976A1 - Host intrusion detection and isolation - Google Patents

Host intrusion detection and isolation Download PDF

Info

Publication number
US20050033976A1
US20050033976A1 US10/634,117 US63411703A US2005033976A1 US 20050033976 A1 US20050033976 A1 US 20050033976A1 US 63411703 A US63411703 A US 63411703A US 2005033976 A1 US2005033976 A1 US 2005033976A1
Authority
US
United States
Prior art keywords
system
computer system
file
host computer
intrusion
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US10/634,117
Inventor
James Doherty
Thomas Adams
Stephen Mueller
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
AT&T Intellectual Property I LP
Original Assignee
AT&T Intellectual Property I LP
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by AT&T Intellectual Property I LP filed Critical AT&T Intellectual Property I LP
Priority to US10/634,117 priority Critical patent/US20050033976A1/en
Priority claimed from US10/605,689 external-priority patent/US7565690B2/en
Assigned to SBC KNOWLEDGE VENTURES, L.P. reassignment SBC KNOWLEDGE VENTURES, L.P. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: ADAMS, THOMAS LEE, DOHERTY, JAMES M., MUELLER, STEPHEN MARK
Publication of US20050033976A1 publication Critical patent/US20050033976A1/en
Application status is Abandoned legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to network resources

Abstract

A host computer system having at least one network interface interfaced with a computer network is operated in a multi-user mode. An intrusion event is detected using a system daemon. In response to detecting the intrusion event, the at least one network interface is isolated from the computer network and the host computer system taken down to a single user state so that access to the host computer system is limited to physical access at the host computer system.

Description

    BACKGROUND OF THE INVENTION
  • 1. Field of the Disclosure
  • The present disclosure relates to methods and systems for intrusion detection.
  • 2. Description of the Related Art
  • Intrusion detection and other forms of computer system security can be categorized as being either an external scheme or an internal scheme. Examples of external security elements include firewalls and routers. An example of an act performed by an external security element is port monitoring, which comprises watching traffic at critical incoming ports. External security elements may be used to provide protection against denial of service (DOS) attacks. Firewalls can also provide port forwarding and DMZ-type applications. External security elements often do not limit outgoing port connections.
  • Internal protection schemes are designed to prevent security breaches by use of file permission, directory access and execution permission. The aforementioned examples of internal protection are usually set as part of a computer's file system. Internal protection schemes prevent unauthorized users from accessing certain aspects of the system that could cause damage or provide unauthorized access to sensitive material.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • The present invention is pointed out with particularity in the appended claims. However, other features are described in the following detailed description in conjunction with the accompanying drawing in which:
  • FIG. 1 is a schematic, block diagram of an embodiment of an intrusion detection system;
  • FIG. 2 is a flow chart of an embodiment of an intrusion detection method; and
  • FIG. 3 is an embodiment of a configuration file for use in intrusion detection.
  • DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
  • Disclosed embodiments make use of several computer functions to provide comprehensive intrusion detection and appropriate isolation procedures. The procedures are implemented programmatically and executed in a real-time, continuous manner.
  • Particular embodiments are described with reference to FIG. 1, which is a schematic, block diagram of an embodiment of an intrusion detection system, and FIG. 2, which is a flow chart of an embodiment of an intrusion detection method. The system and method provide intrusion detection for a host system 10. The host system 10 comprises one or more computers that are accessible via a computer network 12. Examples of the host system 10 include, but are not limited to, a server computer, a corporate mainframe computer, and a desktop computer. Examples of the computer network 12 include, but are not limited to, an Internet, an intranet, an extranet, a local area network and a wide area network.
  • The host system 10 comprises a plurality of network interfaces 14 for interfacing with the computer network 12. For purposes of illustration and example, the host system 10 is depicted to have two network interfaces 14, although those having ordinary skill will recognize that the host system 10 may have an arbitrary number of network interfaces in practice. Examples of the network interfaces 14 include, but are not limited to, Ethernet interfaces.
  • As indicated by block 20, an intrusion detection system daemon 22 of the host system 10 is executed. The system daemon 22 may be started through a normal startup procedure of the host system 10. In embodiments where the host system 10 is UNIX-based, the system daemon 22 may comprise a JTRIP daemon as depicted in FIG. 1.
  • As indicated by block 24, the system daemon 22 reads a configuration file 26. The configuration file 26 may be named JTRIP.CONF as depicted in FIG. 1. The configuration file 26 indicates which directories and files in a file system 30 of the host system 10 are to be monitored by the system daemon 22.
  • The configuration file 26 comprises a script of a plurality of directives. The directives include a first directive type, “DIR”, that indicates a directory whose members (e.g., all of the files in the directory) are to be monitored by the system daemon 22. A second directive type, “FILE”, indicates a particular file that is to be monitored by the system daemon 22. A third directive type, “CONF”, indicates a configuration file that is to be monitored by the system daemon 22. The system daemon 22 monitors the configuration file identified by “CONF” on a different schedule than vendor-supplied control files identified by “DIR” and “FILE”.
  • FIG. 3 shows an example of the configuration file 26. The configuration file 26 comprises four “DIR” directives 32 to tell the system daemon 22 to monitor all members of the /bin directory, the /sbin directory, the /usr/sbin directory, and the /usr/local/sbin directory for intrusion. A “FILE” directive 34 tells the system daemon 22 to monitor a file at /etc/hosts.equiv for intrusion. A “CONF” directive 36 tells the system daemon 22 to monitor a configuration file at /etc/pam.conf for intrusion, but at a different schedule than the other files and directories.
  • As indicated by block 40, the system daemon 22 determines which directories, system files and configuration files are to be monitored based on the configuration file 26.
  • As indicated by block 42, the system daemon 22 reads a valid known Message Digest 5 (MD5) signature and a correct permission for each file that is to be monitored. The aforementioned information is read from an MD5 database 44 located on a system isolated physically and programmatically from the host system 10. The MD5 signature comprises a 128-bit message digest for each file regardless of the length of the file. The MD5 signature for each file to be monitored is computed in advance and stored in the MD5 database 44.
  • As indicated by block 46, the system daemon 22 determines if an intrusion event has occurred. This act is performed repeatedly, for example multiple times (e.g., two or three times) per day.
  • The system daemon 22 detects an intrusion when a modification is made to any monitored file or directory in the file system 30, or when an incorrect permission is associated with any monitored file or directory in the file system 30, or when any monitored file or directory in the file system 30 has an improper ownership, or when any monitored file or directory in the file system 30 no longer exists. A modification to a monitored file is detected by computing a current MD5 signature of the monitored file in the file system 30, and comparing the current MD5 signature to the stored, trusted MD5 signature in the MD5 database 44. An intrusion event is detected if the two MD5 signatures differ.
  • If no intrusion event is detected, the host system 10 continues in its normal operating mode to allow external access thereto via the network interfaces 14. Typically, the normal operating mode is a multi-user state wherein multiple users can access the host system 10 via the computer network 12.
  • If an intrusion event is detected, the system daemon 22 generates an alarm. In response thereto, the host system 10 performs acts to protect the rest of the computer network 12 from a potentially-compromised system. As indicated by block 50, a log is written to a SYSLOGD database 52 that is not located on the host computer system 10 or the MD5 database system 44. The log indicates specifics of the intrusion event, such as a time, a date, which one or more files and/or directories triggered the intrusion event, a current MD5 signature associated with a modified file, and a cause of the intrusion event. The cause of the intrusion event may indicate a file or directory has been changed, a file or directory no longer exists, an incorrect permission, or an improper ownership.
  • As indicated by block 54, one or more commands are issued to the network interfaces 14 to isolate the host system 10 from the computer network 12. In one embodiment, the one or more commands may comprise one or more IFCONFIG down commands.
  • As indicated by block 56, one or more commands are issued to take the host system 10 down to a single user state. In one embodiment, the one or more commands comprise one or more INIT 1 commands issued by the operating system of the host system 10. As a result, access to the host system 10 is limited to physical access at the host system 10 itself, e.g., using a keyboard, pointing device, or other user-input device of the host system 10.
  • It is noted that the acts indicated by blocks 50, 54 and 56 can be performed either in a different order than depicted in FIG. 2, or in parallel, in alternative embodiments.
  • All communications of the system daemon 22 with the MD5 database 44 and the SYSLOGD database 52 are made via port forwarding using Secure Shell (SSH) tunneling or an alternative protocol to securely access a remote computer. This protects the communications from eavesdropping and man-in-the-middle attacks.
  • Those having ordinary skill will recognize that the herein-disclosed computer-implemented acts can be directed by computer-readable program code stored by a computer-readable medium. Examples of the computer-readable medium include, but are not limited to, a magnetic medium such as a hard disk or a floppy disk, an optical medium such as an optical disk (e.g., a CD or a DVD), or an electronic medium such as an electronic memory (e.g., a computer's internal memory or a removable memory such as a memory card).
  • It will be apparent to those skilled in the art that the disclosed embodiments may be modified in numerous ways and may assume many embodiments other than the particular forms specifically set out and described herein. For example, other data verification methods that map a file of arbitrary length to a fixed-length signature can be used in place of MD5. More generally, alternative data verification methods can be substituted for MD5.
  • The above disclosed subject matter is to be considered illustrative, and not restrictive, and the appended claims are intended to cover all such modifications, enhancements, and other embodiments which fall within the true spirit and scope of the present invention. Thus, to the maximum extent allowed by law, the scope of the present invention is to be determined by the broadest permissible interpretation of the following claims and their equivalents, and shall not be restricted or limited by the foregoing detailed description.

Claims (27)

1. A method comprising:
providing a host computer system having at least one network interface interfaced with a computer network;
operating the host computer system in a multi-user mode;
detecting an intrusion event using a system daemon; and
in response to detecting the intrusion event, isolating the at least one network interface from the computer network and taking the host computer system down to a single user state so that access to the host computer system is limited to physical access at the host computer system.
2. The method of claim 1 wherein the system daemon comprises a JTRIP system daemon.
3. The method of claim 1 wherein said isolating the at least one network interface from the computer network comprises issuing an IFCONFIG down command to the at least one network interface.
4. The method of claim 1 wherein said taking the host computer system down to the single user state comprises issuing an INIT1 command to an operating system of the host computer system.
5. The method of claim 1 further comprising:
reading, by the system daemon, a configuration file that indicates at least one file in a file system of the host computer system to be monitored for intrusion.
6. The method of claim 5 wherein the configuration file comprises a first directive type that indicates a directory whose members are to be monitored for intrusion, a second directive type that indicates a file to be monitored for intrusion, and a third directive type that indicates another configuration file to be monitored for intrusion.
7. The method of claim 1 further comprising:
computing a data verification signature for a monitored file in a file system of the host computer system; and
comparing the data verification signature to a valid data verification signature for the monitored file;
wherein said detecting the intrusion event comprises detecting that the data verification signature differs from the valid data verification signature.
8. The method of claim 7 wherein the valid data verification signature comprises a Message Digest 5 (MD5) signature.
9. The method of claim 7 further comprising:
reading the valid data verification signature for the monitored file from a database that is located on a second computer system isolated physically and programmatically from the host computer system.
10. The method of claim 9 further comprising:
writing a log of the intrusion event to a log database that is not located on the host computer system or second computer system.
11. The method of claim I wherein said detecting the intrusion event comprises detecting an incorrect permission associated with a file in a file system of the host computer system.
12. The method of claim 1 wherein said detecting the intrusion event comprises detecting an incorrect ownership associated with a file in a file system of the host computer system.
13. The method of claim 1 wherein said detecting the intrusion event comprises detecting that a file no longer exists in a file system of the host computer system.
14. A method comprising:
providing a host computer system having at least one network interface interfaced with a computer network;
operating the host computer system in a multi-user mode;
executing a JTRIP system daemon on the host computer system;
reading, by the JTRIP system daemon, a configuration file that indicates at least one file in a file system of the host computer system to be monitored for intrusion, wherein the configuration file comprises a first directive type that indicates a directory whose members are to be monitored for intrusion, a second directive type that indicates a file to be monitored for intrusion, and a third directive type that indicates another configuration file to be monitored for intrusion;
reading a valid MD5 signature for a monitored file from a database that is located on a second computer system isolated physically and programmatically from the host computer system;
detecting an intrusion event using the JTRIP system daemon by detecting that an MD5 signature of the monitored file differs from the valid MD5 signature; and
in response to detecting the intrusion event:
issuing an IFCONFIG down command to the at least one network interface to isolate the at least one network interface from the computer network;
issuing an INIT1 command to an operating system of the host computer system to take the host computer system down to a single user state; and
writing a log of the intrusion event to a log database that is not located on the second computer system.
15. A system comprising:
a host computer system having at least one network interface interfaced with a computer network, the host computer system to:
operate in a multi-user mode;
detect an intrusion event using a system daemon; and
in response to detecting the intrusion event, isolate the at least one network interface from the computer network and take the host computer system down to a single user state so that access to the host computer system is limited to physical access at the host computer system.
16. The system of claim 15 wherein the system daemon comprises a JTRIP system daemon.
17. The system of claim 15 wherein the host computer system is to isolate the at least one network interface from the computer network by issuing an IFCONFIG down command to the at least one network interface.
18. The system of claim 15 wherein the host computer system is taken down to the single user state by issuing an INIT1 command to an operating system of the host computer system.
19. The system of claim 15 wherein the host computer system is further to read, by the system daemon, a configuration file that indicates at least one file in a file system of the host computer system to be monitored for intrusion.
20. The system of claim 19 wherein the configuration file comprises a first directive type that indicates a directory whose members are to be monitored for intrusion, a second directive type that indicates a file to be monitored for intrusion, and a third directive type that indicates another configuration file to be monitored for intrusion.
21. The system of claim 15 wherein the host computer system is further to:
compute a data verification signature for a monitored file in a file system of the host computer system; and
compare the data verification signature to a valid data verification signature for the monitored file;
wherein the intrusion event is detected by detecting that the data verification signature differs from the valid data verification signature.
22. The system of claim 21 wherein the valid data verification signature comprises a Message Digest 5 (MD5) signature.
23. The system of claim 21 further comprising:
a second computer system isolated physically and programmatically from the host computer system;
wherein the host computer system is to read the valid data verification signature for the monitored file from a database that is located on the second computer system.
24. The system of claim 23 further comprising:
a log database not located on the host computer system or the second computer system;
wherein the host computer system is further to write a log of the intrusion event to the log database.
25. The system of claim 15 wherein the intrusion event comprises an incorrect permission associated with a file in a file system of the host computer system.
26. The system of claim 15 wherein the intrusion event comprises an incorrect ownership associated with a file in a file system of the host computer system.
27. The system of claim 15 wherein the intrusion event comprises a file no longer existing in a file system of the host computer system.
US10/634,117 2003-08-04 2003-08-04 Host intrusion detection and isolation Abandoned US20050033976A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US10/634,117 US20050033976A1 (en) 2003-08-04 2003-08-04 Host intrusion detection and isolation

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US10/634,117 US20050033976A1 (en) 2003-08-04 2003-08-04 Host intrusion detection and isolation
US10/605,689 US7565690B2 (en) 2003-08-04 2003-10-17 Intrusion detection
PCT/US2004/022743 WO2005031499A2 (en) 2003-08-04 2004-07-16 Host intrusion detection and isolation

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US10/605,689 Continuation-In-Part US7565690B2 (en) 2003-08-04 2003-10-17 Intrusion detection

Publications (1)

Publication Number Publication Date
US20050033976A1 true US20050033976A1 (en) 2005-02-10

Family

ID=34115977

Family Applications (1)

Application Number Title Priority Date Filing Date
US10/634,117 Abandoned US20050033976A1 (en) 2003-08-04 2003-08-04 Host intrusion detection and isolation

Country Status (1)

Country Link
US (1) US20050033976A1 (en)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070028110A1 (en) * 2005-07-29 2007-02-01 Bit 9, Inc. Content extractor and analysis system
US20070028303A1 (en) * 2005-07-29 2007-02-01 Bit 9, Inc. Content tracking in a network security system
US20070028291A1 (en) * 2005-07-29 2007-02-01 Bit 9, Inc. Parametric content control in a network security system
US20070028304A1 (en) * 2005-07-29 2007-02-01 Bit 9, Inc. Centralized timed analysis in a network security system
US20090158437A1 (en) * 2005-11-18 2009-06-18 Te-Hyun Kim Method and system for digital rights management among apparatuses
WO2013184099A1 (en) * 2012-06-05 2013-12-12 Empire Technology Development, Llc Cross-user correlation for detecting server-side multi-target intrusion

Citations (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5864683A (en) * 1994-10-12 1999-01-26 Secure Computing Corporartion System for providing secure internetwork by connecting type enforcing secure computers to external network for limiting access to data based on user and process access rights
US5918018A (en) * 1996-02-09 1999-06-29 Secure Computing Corporation System and method for achieving network separation
US5923884A (en) * 1996-08-30 1999-07-13 Gemplus S.C.A. System and method for loading applications onto a smart card
US6282546B1 (en) * 1998-06-30 2001-08-28 Cisco Technology, Inc. System and method for real-time insertion of data into a multi-dimensional database for network intrusion detection and vulnerability assessment
US6289462B1 (en) * 1998-09-28 2001-09-11 Argus Systems Group, Inc. Trusted compartmentalized computer operating system
US20010025311A1 (en) * 2000-03-22 2001-09-27 Masato Arai Access control system
US6298445B1 (en) * 1998-04-30 2001-10-02 Netect, Ltd. Computer security
US6301668B1 (en) * 1998-12-29 2001-10-09 Cisco Technology, Inc. Method and system for adaptive network security using network vulnerability assessment
US6321338B1 (en) * 1998-11-09 2001-11-20 Sri International Network surveillance
US6324656B1 (en) * 1998-06-30 2001-11-27 Cisco Technology, Inc. System and method for rules-driven multi-phase network vulnerability assessment
US20020046275A1 (en) * 2000-06-12 2002-04-18 Mark Crosbie System and method for host and network based intrusion detection and response
US20020083343A1 (en) * 2000-06-12 2002-06-27 Mark Crosbie Computer architecture for an intrusion detection system
US6415321B1 (en) * 1998-12-29 2002-07-02 Cisco Technology, Inc. Domain mapping method and system
US20020129264A1 (en) * 2001-01-10 2002-09-12 Rowland Craig H. Computer security and management system
US20020144140A1 (en) * 2001-03-30 2002-10-03 Ellison Carl M. File checking using remote signing authority via a network
US6484315B1 (en) * 1999-02-01 2002-11-19 Cisco Technology, Inc. Method and system for dynamically distributing updates in a network
US6487666B1 (en) * 1999-01-15 2002-11-26 Cisco Technology, Inc. Intrusion detection signature analysis using regular expressions and logical operators
US6499107B1 (en) * 1998-12-29 2002-12-24 Cisco Technology, Inc. Method and system for adaptive network security using intelligent packet analysis
US6567917B1 (en) * 1999-02-01 2003-05-20 Cisco Technology, Inc. Method and system for providing tamper-resistant executable software
US6578147B1 (en) * 1999-01-15 2003-06-10 Cisco Technology, Inc. Parallel intrusion detection sensors with load balancing for high speed networks
US20030126468A1 (en) * 2001-05-25 2003-07-03 Markham Thomas R. Distributed firewall system and method
US6647400B1 (en) * 1999-08-30 2003-11-11 Symantec Corporation System and method for analyzing filesystems to detect intrusions
US20040049693A1 (en) * 2002-09-11 2004-03-11 Enterasys Networks, Inc. Modular system for detecting, filtering and providing notice about attack events associated with network security
US20040117310A1 (en) * 2002-08-09 2004-06-17 Mendez Daniel J. System and method for preventing access to data on a compromised remote device
US7032114B1 (en) * 2000-08-30 2006-04-18 Symantec Corporation System and method for using signatures to detect computer intrusions

Patent Citations (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5864683A (en) * 1994-10-12 1999-01-26 Secure Computing Corporartion System for providing secure internetwork by connecting type enforcing secure computers to external network for limiting access to data based on user and process access rights
US5918018A (en) * 1996-02-09 1999-06-29 Secure Computing Corporation System and method for achieving network separation
US6219707B1 (en) * 1996-02-09 2001-04-17 Secure Computing Corporation System and method for achieving network separation
US5923884A (en) * 1996-08-30 1999-07-13 Gemplus S.C.A. System and method for loading applications onto a smart card
US6298445B1 (en) * 1998-04-30 2001-10-02 Netect, Ltd. Computer security
US6282546B1 (en) * 1998-06-30 2001-08-28 Cisco Technology, Inc. System and method for real-time insertion of data into a multi-dimensional database for network intrusion detection and vulnerability assessment
US6324656B1 (en) * 1998-06-30 2001-11-27 Cisco Technology, Inc. System and method for rules-driven multi-phase network vulnerability assessment
US6289462B1 (en) * 1998-09-28 2001-09-11 Argus Systems Group, Inc. Trusted compartmentalized computer operating system
US6321338B1 (en) * 1998-11-09 2001-11-20 Sri International Network surveillance
US6499107B1 (en) * 1998-12-29 2002-12-24 Cisco Technology, Inc. Method and system for adaptive network security using intelligent packet analysis
US6301668B1 (en) * 1998-12-29 2001-10-09 Cisco Technology, Inc. Method and system for adaptive network security using network vulnerability assessment
US6415321B1 (en) * 1998-12-29 2002-07-02 Cisco Technology, Inc. Domain mapping method and system
US6578147B1 (en) * 1999-01-15 2003-06-10 Cisco Technology, Inc. Parallel intrusion detection sensors with load balancing for high speed networks
US6487666B1 (en) * 1999-01-15 2002-11-26 Cisco Technology, Inc. Intrusion detection signature analysis using regular expressions and logical operators
US6567917B1 (en) * 1999-02-01 2003-05-20 Cisco Technology, Inc. Method and system for providing tamper-resistant executable software
US6484315B1 (en) * 1999-02-01 2002-11-19 Cisco Technology, Inc. Method and system for dynamically distributing updates in a network
US6647400B1 (en) * 1999-08-30 2003-11-11 Symantec Corporation System and method for analyzing filesystems to detect intrusions
US20010025311A1 (en) * 2000-03-22 2001-09-27 Masato Arai Access control system
US20020046275A1 (en) * 2000-06-12 2002-04-18 Mark Crosbie System and method for host and network based intrusion detection and response
US20020083343A1 (en) * 2000-06-12 2002-06-27 Mark Crosbie Computer architecture for an intrusion detection system
US7032114B1 (en) * 2000-08-30 2006-04-18 Symantec Corporation System and method for using signatures to detect computer intrusions
US20020129264A1 (en) * 2001-01-10 2002-09-12 Rowland Craig H. Computer security and management system
US20020144140A1 (en) * 2001-03-30 2002-10-03 Ellison Carl M. File checking using remote signing authority via a network
US20030126468A1 (en) * 2001-05-25 2003-07-03 Markham Thomas R. Distributed firewall system and method
US20040117310A1 (en) * 2002-08-09 2004-06-17 Mendez Daniel J. System and method for preventing access to data on a compromised remote device
US20040049693A1 (en) * 2002-09-11 2004-03-11 Enterasys Networks, Inc. Modular system for detecting, filtering and providing notice about attack events associated with network security

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070028110A1 (en) * 2005-07-29 2007-02-01 Bit 9, Inc. Content extractor and analysis system
US20070028303A1 (en) * 2005-07-29 2007-02-01 Bit 9, Inc. Content tracking in a network security system
US20070028291A1 (en) * 2005-07-29 2007-02-01 Bit 9, Inc. Parametric content control in a network security system
US20070028304A1 (en) * 2005-07-29 2007-02-01 Bit 9, Inc. Centralized timed analysis in a network security system
US7895651B2 (en) 2005-07-29 2011-02-22 Bit 9, Inc. Content tracking in a network security system
US8272058B2 (en) 2005-07-29 2012-09-18 Bit 9, Inc. Centralized timed analysis in a network security system
US8984636B2 (en) 2005-07-29 2015-03-17 Bit9, Inc. Content extractor and analysis system
US20090158437A1 (en) * 2005-11-18 2009-06-18 Te-Hyun Kim Method and system for digital rights management among apparatuses
WO2013184099A1 (en) * 2012-06-05 2013-12-12 Empire Technology Development, Llc Cross-user correlation for detecting server-side multi-target intrusion
US9197653B2 (en) 2012-06-05 2015-11-24 Empire Technology Development Llc Cross-user correlation for detecting server-side multi-target intrusion
US9882920B2 (en) 2012-06-05 2018-01-30 Empire Technology Development Llc Cross-user correlation for detecting server-side multi-target intrusion

Similar Documents

Publication Publication Date Title
Deswarte et al. Remote integrity checking
US7779062B2 (en) System for preventing keystroke logging software from accessing or identifying keystrokes
US7140044B2 (en) Data security system and method for separation of user communities
Halcrow Demands, solutions, and improvements for Linux filesystem security
US5475839A (en) Method and structure for securing access to a computer system
EP2837131B1 (en) System and method for determining and using local reputations of users and hosts to protect information in a network environment
US8407784B2 (en) Method and system for protection against information stealing software
US6772332B1 (en) System and method for providing secure internetwork services via an assured pipeline
US7334264B2 (en) Computer virus generation detection apparatus and method
JP5019869B2 (en) Method of providing access to encrypted data on the computer device
US20060294589A1 (en) Method/system to speed up antivirus scans using a journal file system
US7788235B1 (en) Extrusion detection using taint analysis
US6883098B1 (en) Method and computer system for controlling access by applications to this and other computer systems
Curry UNIX system security
US20090158430A1 (en) Method, system and computer program product for detecting at least one of security threats and undesirable computer files
US20020141588A1 (en) Data security for digital data storage
US9130986B2 (en) Method and system for protection against information stealing software
US20030065793A1 (en) Anti-virus policy enforcement system and method
US20100017546A1 (en) Method, apparatus and system for authentication of external storage devices
US20130333036A1 (en) System, method and program for identifying and preventing malicious intrusions
US7665123B1 (en) Method and apparatus for detecting hidden rootkits
US7716743B2 (en) Privacy friendly malware quarantines
US6253324B1 (en) Server verification of requesting clients
US20060130144A1 (en) Protecting computing systems from unauthorized programs
US7945787B2 (en) Method and system for detecting malware using a remote server

Legal Events

Date Code Title Description
AS Assignment

Owner name: SBC KNOWLEDGE VENTURES, L.P., NEVADA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:DOHERTY, JAMES M.;ADAMS, THOMAS LEE;MUELLER, STEPHEN MARK;REEL/FRAME:014326/0580

Effective date: 20031114